@passioncode-ai/passioncode 0.2.37 → 0.2.38

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.2.38 - 2026-10-26
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.49.3`** (it was `v0.49.2`): Fabric's button in the dashboard kit shows
+  Russian on a Russian page and takes a page's own words, with no em dash, and a remote service registers the
+  repository of its code. Notes are in the adapter's CHANGELOG.
+
 ## 0.2.37 - 2026-10-24
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.49.2",
+      "ref": "v0.49.3",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.2.37",
+  "version": "0.2.38",
   "description": "Set up PassionCode.ai on a computer with one command — the apps from their verified releases, their MCP servers for every coding agent and the PassionCode.ai skills — and check and repair it with the same command or `doctor`.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.49.2",
+      "version": "0.49.3",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.2.37",
+      "version": "0.2.38",
       "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.2.37",
+  "version": "0.2.38",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.49.2",
-      "commit": "ee2407257bcad04f2e135a59df7899d41453b7e8",
-      "version": "0.49.2",
+      "ref": "v0.49.3",
+      "commit": "103b00b003421925d5667d86c6ac7730bf57e03a",
+      "version": "0.49.3",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -23,7 +23,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:dc2ff2c25f68f9698432cc08c563ee565138b770c6b34e1cf5a95ce37ca24cd7",
+      "contentHash": "sha256:6567a762c2c2bfb836248862601b6bfcdaa798aa490658f7f7a37c3a2050f248",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
       "author": {
         "name": "PassionCode.ai",
@@ -62,9 +62,9 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.2.37",
+      "ref": "v0.2.38",
       "commit": null,
-      "version": "0.2.37",
+      "version": "0.2.38",
       "via": "this repository",
       "skills": [
         "setting-up-passioncode",
@@ -72,7 +72,7 @@
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:bcae9796e81b691ef3c93f2d70aaec6863f7861adcf0c31a5e8f0570fc573572",
+      "contentHash": "sha256:f8b5ed5742797df4e4ec6bffea0f19ba6f6f70f2292b113c3b29ac2d006a338e",
       "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.49.2",
+  "version": "0.49.3",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.49.2"
+  version: "0.49.3"
   contract-version: "0.1.0"
   contract-commit: "2f020a696453ae299b123517f14957f6a1354379"
 ---

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/provider-entry.md

@@ -53,7 +53,9 @@ It refuses, with one sentence that never quotes a value:
   1024 characters), a shell-string command, more than 32 arguments or one over 1024 characters, more than 64 env
   names, a `source.repository` that is not an absolute URI, an `installedAt` that is not an RFC 3339 date-time,
   unknown fields. The patterns are the schema's, copied (`test_provider.SchemaParityTests` compares them with a
-  contract checkout at the pin when `FABRIC_CONTRACT_NEW` names one).
+  contract checkout at the pin when `FABRIC_CONTRACT_NEW` names one);
+- a `source.repository` with a `user:password@` or a value shaped like a credential: it names the repository, never
+  reaches it (since 0.49.3, as the service kit's descriptor check).
 
 `validate` also checks that the file is named `<id>.json` (FAC-SEM-014, slug half).
 From Python: `write_provider_entry(entry)`, `remove_provider_entry(id)`,

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_provider.py

@@ -47,6 +47,7 @@ ENV_MAX = 64
 # Whole-value patterns end in \Z, never `$` (R1: `$` also matches before a trailing newline).
 _ID = re.compile(r"^[a-z][a-z0-9-]{1,62}\Z")
 _ENV_NAME = re.compile(r"^[A-Z_][A-Z0-9_]*\Z")
+_URI_PASSWORD = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*://[^/?#@]*:[^/?#@]*@")
 _SECRET_REF = re.compile(r"^secret-ref:([A-Za-z0-9][A-Za-z0-9._/:@-]{0,255})\Z")
 _LOCAL_PATH = re.compile(LOCAL_PATH_PATTERN)
 _URL = re.compile(URL_PATTERN)
@@ -131,6 +132,9 @@ def validate_provider_entry(entry: Any) -> List[str]:
             problems.append("source is {repository?}")
         elif "repository" in source and not _is_uri(source["repository"]):
             problems.append("source.repository is an absolute URI")
+        elif "repository" in source and (_URI_PASSWORD.match(source["repository"]) or _secrets.secret_argument(source["repository"])):
+            # FAA-120, as the service kit: a repository is named, never reached with a credential in its URI.
+            problems.append("source.repository carries no password or credential: it names the repository")
     if not isinstance(entry["installedAt"], str) or not _TIMESTAMP.fullmatch(entry["installedAt"]):
         problems.append("installedAt is an RFC 3339 date-time")
     if not isinstance(entry["installedBy"], str) or not 1 <= len(entry["installedBy"]) <= 200:

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -14,7 +14,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits (Node.js 22+ for a Linux service's instance lock); the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.49.2"
+  version: "0.49.3"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "2f020a696453ae299b123517f14957f6a1354379"
@@ -357,8 +357,9 @@ things change and the kits implement each:
    so the platform's copy is known rather than invisible. Without Project Observatory, record
    where the key lives in the person's own secret manager.
 3. **Register it on the operator's computer**, the installer side, run there:
-   `registerRemote({ id, name, origin, token })` / `register_remote(...)` writes the token file
-   (0600) and the descriptor; pass the token from a file or stdin, never in argv. Public names
+   `registerRemote({ id, name, origin, token, source })` / `register_remote(...)` writes the token file
+   (0600) and the descriptor, with `source.repository` naming the code's repository; pass the token from a file or
+   stdin, never in argv. Public names
    only in public artifacts: a private service is registered by a local descriptor and nowhere
    else.
 4. **Verify** with the probe: `check_service.py <id>` checks TLS, the token-gated well-known

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/assets/dashboard-kit/fabric-button.js

@@ -1,16 +1,17 @@
-/* fabric-dashboard-kit@1.1.3 · Fabric's button (Fabric Agent Contract DEC-0040, FB-1…FB-8, FL-1…FL-6)
+/* fabric-dashboard-kit@1.1.4 · Fabric's button (Fabric Agent Contract DEC-0040, FB-1…FB-8, FL-1…FL-6)
    Load it same-origin, after fabric-dashboard.css, with the service it opens Fabric on:
      <script src="fabric-button.js" defer data-service="example-agent.default" data-service-name="Example Agent"
              data-project="project-a" data-project-name="Project A"></script>
    One floating menu button: "Chat with Fabric about <service>" and, when the page knows its project, "Open a coding
-   session in <project>". Its links carry ids only and open a view in Fabric, nothing more (FB-8). It hides itself
+   session in <project>", in Russian on a page whose lang is ru; data-label-chat and data-label-session ({name} is the
+   service or the project), data-label-open and data-label-absent set the page's own words. Its links carry ids only and open a view in Fabric, nothing more (FB-8). It hides itself
    when the host draws its own (the fabric_button cookie, FB-6) and says how to get Fabric when Fabric is absent
    (FB-5). No inline script, no eval, nothing from a CDN; the only address it names is passioncode.ai/fabric.
    Do not edit in place; `dashboard_kit.py install` replaces it on an upgrade. */
 (function (root) {
   'use strict';
 
-  var VERSION = '1.1.3';
+  var VERSION = '1.1.4';
   var COOKIE = 'fabric_button';
   var GET_FABRIC = 'https://passioncode.ai/fabric';
   var ABSENT_AFTER_MS = 1500;
@@ -155,16 +156,38 @@
     return null;
   }
 
+  // The words a person reads (FAA-119): English, or Russian on a page whose lang is ru; the Russian is written as
+  // escapes so the file reads the same whatever charset it is served with. Checked with Copylot (en-US and ru-RU).
+  var LABELS = {
+    en: { chat: 'Chat with Fabric about {name}', session: 'Open a coding session in {name}', open: 'Open Fabric',
+      absent: 'Fabric is not installed. Get it at' },
+    ru: { chat: '\u0427\u0430\u0442 \u0441 Fabric \u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0435 {name}', session: '\u041e\u0442\u043a\u0440\u044b\u0442\u044c \u0441\u0435\u0441\u0441\u0438\u044e \u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u0435 {name}', open: '\u041e\u0442\u043a\u0440\u044b\u0442\u044c Fabric',
+      absent: 'Fabric \u043d\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d. \u0421\u043a\u0430\u0447\u0430\u0439\u0442\u0435 \u0435\u0433\u043e \u043d\u0430' }
+  };
+
+  /** The labels for a page language, each one replaced by a non-blank string the page gives (data-label-*). */
+  function labelsFor(lang, overrides) {
+    var base = LABELS[/^ru(-|$)/i.test(String(lang || '')) ? 'ru' : 'en'];
+    var out = {};
+    Object.keys(base).forEach(function (k) {
+      var own = overrides ? overrides[k] : undefined;
+      out[k] = typeof own === 'string' && own.trim() ? own.trim() : base[k];
+    });
+    return out;
+  }
+  function named(label, name) { return label.split('{name}').join(name); }
+
   /** The menu items for a page: the chat link always, the session link when the page knows its project. */
-  function menuItems(options) {
+  function menuItems(options, labels) {
+    var words = labels || labelsFor();
     var items = [];
     var chat = { action: 'chat', service: options.service };
     if (options.project) chat.project = options.project;
-    items.push({ label: 'Chat with Fabric about ' + (options.serviceName || options.service), href: buildFabricLink(chat) });
+    items.push({ label: named(words.chat, options.serviceName || options.service), href: buildFabricLink(chat) });
     if (options.project) {
       var session = { action: 'session.new', project: options.project };
       if (options.runner) session.runner = options.runner;
-      items.push({ label: 'Open a coding session in ' + (options.projectName || options.project), href: buildFabricLink(session) });
+      items.push({ label: named(words.session, options.projectName || options.project), href: buildFabricLink(session) });
     }
     return items;
   }
@@ -197,11 +220,12 @@
   function mount(doc, options) {
     var cookie = parseButtonCookie(doc.cookie);
     if (cookie && cookie.owner === 'host') return null;
-    var items = menuItems(options);
+    var words = labelsFor(options.lang !== undefined ? options.lang : doc.documentElement.getAttribute('lang'), options.labels);
+    var items = menuItems(options, words);
     var absent = options.fabric === 'absent' || (cookie && cookie.fabric === 'absent');
 
     var wrap = el(doc, 'div', { 'class': 'fd-fabric-button-wrap' });
-    var button = el(doc, 'button', { type: 'button', 'class': 'fd-fabric-button', 'aria-haspopup': 'menu', 'aria-expanded': 'false', 'aria-label': 'Open Fabric' });
+    var button = el(doc, 'button', { type: 'button', 'class': 'fd-fabric-button', 'aria-haspopup': 'menu', 'aria-expanded': 'false', 'aria-label': words.open });
     button.appendChild(mark(doc));
     button.appendChild(el(doc, 'span', { 'class': 'fd-fabric-button-label', 'aria-hidden': 'true' }, 'Fabric'));
     var menu = el(doc, 'div', { role: 'menu', 'class': 'fd-fabric-button-menu', 'aria-label': 'Fabric' });
@@ -212,7 +236,7 @@
       return a;
     });
     var note = el(doc, 'p', { 'class': 'fd-fabric-button-note', role: 'note' });
-    note.appendChild(doc.createTextNode('Fabric is not installed. Get it at '));
+    note.appendChild(doc.createTextNode(words.absent + ' '));
     // The way to get Fabric is a menu item too, so the arrows reach it whenever the note shows.
     var get = el(doc, 'a', { role: 'menuitem', href: GET_FABRIC, target: '_blank', rel: 'noopener', tabindex: '-1', 'class': 'fd-fabric-button-get' }, 'passioncode.ai/fabric');
     note.appendChild(get);
@@ -274,18 +298,19 @@
 
   function optionsFrom(script) {
     var d = script.dataset;
-    return { service: d.service, serviceName: d.serviceName, project: d.project, projectName: d.projectName, runner: d.runner, fabric: d.fabric };
+    return { service: d.service, serviceName: d.serviceName, project: d.project, projectName: d.projectName, runner: d.runner, fabric: d.fabric,
+      labels: { chat: d.labelChat, session: d.labelSession, open: d.labelOpen, absent: d.labelAbsent } };
   }
 
   var api = { version: VERSION, parseFabricLink: parseFabricLink, buildFabricLink: buildFabricLink, parseButtonCookie: parseButtonCookie,
-    menuItems: menuItems, credentialName: credentialName, secretValue: secretValue, nameWords: nameWords, mount: mount };
+    menuItems: menuItems, labelsFor: labelsFor, credentialName: credentialName, secretValue: secretValue, nameWords: nameWords, mount: mount };
   root.FabricButton = api;
 
   var doc = root.document;
   var script = doc && doc.currentScript;
   if (script && script.dataset && script.dataset.service) {
     var start = function () {
-      try { mount(doc, optionsFrom(script)); } catch (err) { if (root.console) root.console.warn('fabric-button: not shown — ' + err.message); }
+      try { mount(doc, optionsFrom(script)); } catch (err) { if (root.console) root.console.warn('fabric-button: not shown: ' + err.message); }
     };
     if (doc.readyState === 'loading') doc.addEventListener('DOMContentLoaded', start); else start();
   }

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/assets/dashboard-kit/fabric-dashboard.css

@@ -1,4 +1,4 @@
-/* fabric-dashboard-kit@1.1.3 · fabric-dashboard/0.1 (Fabric Agent Contract DEC-0036)
+/* fabric-dashboard-kit@1.1.4 · fabric-dashboard/0.1 (Fabric Agent Contract DEC-0036)
    A Fabric service dashboard shown inside a host pane: usable from 360 CSS px up, navigation always
    reachable, wide content in its own scroll box, one vertical scroller, appearance from the host.
    Copy this file next to fabric-dashboard.js; do not edit it in place. Put the page's own rules in

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/assets/dashboard-kit/fabric-dashboard.js

@@ -1,4 +1,4 @@
-/* fabric-dashboard-kit@1.1.3 · fabric-dashboard/0.1 (Fabric Agent Contract DEC-0036)
+/* fabric-dashboard-kit@1.1.4 · fabric-dashboard/0.1 (Fabric Agent Contract DEC-0036)
    Load it same-origin with <script src="fabric-dashboard.js" defer></script>: no inline script, no
    eval, nothing from a CDN. It applies the host's appearance (ED-6, ED-8), folds navigation that
    does not fit into a More menu (ED-3), makes wide boxes keyboard-reachable (ED-4) and keeps
@@ -8,7 +8,7 @@
   'use strict';
 
   var KIT = 'fabric-dashboard-kit';
-  var VERSION = '1.1.3';
+  var VERSION = '1.1.4';
   /* fabric-dashboard-kit:theme-ids:begin */
   var THEMES = ['graphite', 'fabric', 'paper', 'forest', 'ocean', 'ember', 'contrast'];
 /* fabric-dashboard-kit:theme-ids:end */

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/assets/dashboard-kit/kit.json

@@ -1,6 +1,6 @@
 {
   "name": "fabric-dashboard-kit",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "profile": "fabric-dashboard/0.1",
   "decision": "DEC-0036",
   "declarationKey": "https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1",
@@ -15,9 +15,9 @@
     "contrast"
   ],
   "files": {
-    "fabric-dashboard.css": "fdcc7dadea987f0b89c63a5460b3b2b2c870768decc9ee981824a0dc0095169e",
-    "fabric-dashboard.js": "a69f80211132bb36c7a8d297d89674f0fafc087121289abf8cbebb6034e03235",
-    "fabric-button.js": "7f35ff22226e2c57e6ba980424fc839207ad150d1f235043296f9ac0fb5425a1",
+    "fabric-dashboard.css": "c9367aad04c662547aec61e67e10b99d80ec1d1c4618b4473bc2db882d80db94",
+    "fabric-dashboard.js": "5f157d185d9b04e9a11e680399503bbae924520ed0c112b734bf59fc8ee6bb49",
+    "fabric-button.js": "2906d3533635df2ed1f2f071abe00238d30ea81666ff34c3456b376526b66859",
     "themes.json": "511839f1a1a83eb37fadfd132791474497d5c28c5091700b9aa31ad076e359b5"
   },
   "history": {
@@ -44,6 +44,11 @@
       "fabric-dashboard.css": "fdcc7dadea987f0b89c63a5460b3b2b2c870768decc9ee981824a0dc0095169e",
       "fabric-dashboard.js": "a69f80211132bb36c7a8d297d89674f0fafc087121289abf8cbebb6034e03235",
       "fabric-button.js": "7f35ff22226e2c57e6ba980424fc839207ad150d1f235043296f9ac0fb5425a1"
+    },
+    "1.1.4": {
+      "fabric-dashboard.css": "c9367aad04c662547aec61e67e10b99d80ec1d1c4618b4473bc2db882d80db94",
+      "fabric-dashboard.js": "5f157d185d9b04e9a11e680399503bbae924520ed0c112b734bf59fc8ee6bb49",
+      "fabric-button.js": "2906d3533635df2ed1f2f071abe00238d30ea81666ff34c3456b376526b66859"
     }
   }
 }

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/dashboard-kit.md

@@ -93,9 +93,15 @@ service. Load it after the stylesheet, with ids only:
 
 - **The menu (FB-4):** "Chat with Fabric about *Example Agent*" always; "Open a coding session in *Project A*" when
   the page knows its project (`data-runner` picks the runner kind). Arrows move, Escape closes and returns focus.
+- **Words (since 1.1.4):** English by default, Russian when the page says `<html lang="ru">` (any `ru-*`). The page
+  sets its own with `data-label-chat` and `data-label-session` (`{name}` is the service or the project),
+  `data-label-open` (the button's accessible name) and `data-label-absent` (the sentence before the link to
+  passioncode.ai/fabric). A blank attribute keeps the built-in words; `FabricButton.labelsFor(lang, overrides)` returns
+  what a page gets. Product names stay in English in every language.
 - **Placement and look (FB-2, FB-3):** bottom-right (bottom-left right-to-left), 16 px off and clear of the safe
   area, above the sticky chrome and below dialogs; the page keeps its height plus 16 px free at the end of the
-  scroll. The mark and the word *Fabric*, the mark alone below 480 px; the accessible name is always *Open Fabric*;
+  scroll. The mark and the word *Fabric*, the mark alone below 480 px; the accessible name is *Open Fabric* (*Открыть
+  Fabric* on a Russian page, or the page's `data-label-open`);
   `--ink` on `--panel` with an `--edge` boundary, the pairs the themes are measured on.
 - **Links (FL-1…FL-6):** built with the kit's port of the contract's `buildFabricLink`; a value outside the grammar
   (or one shaped like a credential) means no button, never a bad link. A press opens a view in Fabric and starts

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/remote-placement.md

@@ -31,7 +31,8 @@ same objects (well-known document, events feed, login code) at the same paths.
   "auth": { "tokenFile": "~/Library/Application Support/ai.passioncode.fabric/tokens/example-agent.default.token" },
   "lifecycle": { "manager": "none" },
   "installedAt": "2026-10-02T18:00:00Z",
-  "installedBy": "fabric-service register-remote"
+  "installedBy": "fabric-service register-remote",
+  "source": { "repository": "https://github.com/example/agent" }
 }
 ```
 
@@ -39,6 +40,10 @@ same objects (well-known document, events feed, login code) at the same paths.
   literal; not `localhost`, `*.local`, `*.internal`, `*.home.arpa`, `*.lan`, `*.localdomain`.
 - `lifecycle.manager` is `none`, with no `label` or `plist`. `paths` is optional.
 - `commands` may carry `doctor` (a local executable); never `update`.
+- `source.repository` names the repository of the service's code, so Fabric Dashboards can tell code apart from a store
+  that versions data. Pass it as `registerRemote({ ..., source: { repository } })` / `register_remote(..., source=...)`
+  (since 0.49.3); the kit checks it as the schema's URI (RFC 3986 characters, a host and a valid port when it names an
+  authority) and refuses a `user:password@` or any value shaped like a credential in it.
 - `installedBy` is the installer's name and version as a string (`"example-installer 1.2.0"`), or
   `{by, role?, tool}` where `by` is `person`, `node` or `organization` and `role` (`operator`, `administrator`) is a
   person's only. There is no `agent` kind: an agent that registers a service writes the string form, or

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -742,7 +742,8 @@ class Probe:
             return
         top = inside.stdout.strip()
         remote = subprocess.run(["git", "-C", top, "remote", "get-url", "origin"], capture_output=True, text=True)
-        source = str((self.d.get("source") or {}).get("repository") or "")
+        own = self.d.get("source")
+        source = str(own.get("repository") or "") if isinstance(own, dict) else ""
         if not source:
             self.add(rule, "NOT_RUN", "data is inside repository %s and the descriptor names no source.repository to tell code from data" % top)
         elif remote.returncode == 0 and same_repository(remote.stdout.strip(), source):

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/dashboard_kit.py

@@ -292,7 +292,8 @@ def services_of(repo: Path, directory: Optional[Path] = None, until: Optional[fl
             d = json.loads(path.read_text(encoding="utf-8"))
         except (OSError, ValueError):
             continue
-        source = str(((d.get("source") or {}) if isinstance(d, dict) else {}).get("repository") or "")
+        own = d.get("source") if isinstance(d, dict) else None
+        source = str(own.get("repository") or "") if isinstance(own, dict) else ""
         if same_repository(source, origin):
             found.append("%s.%s" % (d.get("id"), d.get("instance", "default")))
     return found

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-auth.mjs

@@ -262,15 +262,18 @@ export function remoteTokenFile(id, instance = 'default', dir = servicesDir()) {
  * descriptor. DEC-0061: `installedBy` defaults to `{by: 'person', role: 'operator', tool: 'fabric-service register-remote'}`
  * (a person runs this); `runner` (`{kind?, credentialKind}`) says how its model calls sign in, as a kind and never a
  * credential; `peer` (`{endpoint, custody, residency, maxDataClass}`) offers it to others and needs `runner`.
+ * FAA-120: `source` (`{repository: 'https://github.com/owner/name'}`) names the repository of its code, as the schema's
+ * `source.repository`; Fabric Dashboards reads it.
  */
 export function registerRemote({ id, instance = 'default', name, summary, origin, token, doctor, dir = servicesDir(),
-  installedBy = { by: 'person', role: 'operator', tool: 'fabric-service register-remote' }, runner, peer }) {
+  installedBy = { by: 'person', role: 'operator', tool: 'fabric-service register-remote' }, runner, peer, source }) {
   if (!token || String(token).trim().length < 16) throw new ServiceError('the service token must be at least 16 characters.');
   const tokenFile = remoteTokenFile(id, instance, dir);
   const d = {
     protocol: PROTOCOL, id, instance, name, ...(summary ? { summary } : {}), placement: 'remote', origin,
     auth: { tokenFile }, lifecycle: { manager: 'none' }, ...(doctor ? { commands: { doctor } } : {}),
     installedAt: nowIso(), installedBy, ...(runner ? { runner: { ...runner } } : {}), ...(peer ? { peer: { ...peer } } : {}),
+    ...(source != null ? { source: isPlainObject(source) ? { ...source } : source } : {}),
   };
   const problems = validateDescriptor(d);
   if (problems.length) throw new ServiceError(`Descriptor is invalid: ${problems.join('; ')}.`);

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-descriptor.mjs

@@ -13,7 +13,7 @@ import { ROUTES } from './fabric-usage.mjs';
 // document's `extensions`. The kit is assets/dashboard-kit; its version is the one in kit.json.
 export const DASHBOARD_EXTENSION_KEY = 'https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1';
 
-export const DASHBOARD_KIT = 'fabric-dashboard-kit@1.1.3';
+export const DASHBOARD_KIT = 'fabric-dashboard-kit@1.1.4';
 
 export const REFERENCE_THEMES = ['graphite', 'fabric', 'paper', 'forest', 'ocean', 'ember', 'contrast'];
 
@@ -125,6 +125,20 @@ export const SUBSCRIPTION_RUNNERS = Object.freeze({ 'claude-code': 'claude', 'ki
 
 const PEER_ENDPOINT = /^https:\/\/((?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63})(:([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*)?$/;
 
+// FAA-120: source.repository is the schema's common `uri`: RFC 3986 characters only (unreserved, reserved and %HH),
+// the same in both twins; an authority, when there is one, names a host and a port of digits up to 65535, as Fabric's
+// `new URL` reads it. A user:password@ in it is a credential, never the name of a repository.
+const SOURCE_URI = /^[A-Za-z][A-Za-z0-9+.-]*:(?:[A-Za-z0-9._~:/?#@!$&'()*+,;=-]|%[0-9A-Fa-f]{2})+$/;
+// Brackets belong to an IP-literal host only (RFC 3986 3.2.2); the literal is set aside before the character check.
+const IP_LITERAL = /^([A-Za-z][A-Za-z0-9+.-]*:\/\/(?:[^/?#@[\]]*@)?)\[[0-9A-Fa-f:.vV]+\]/;
+const URI_AUTHORITY = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/(?:[^/?#@]*@)?(\[[^\]]*\]|[^/?#:]*)(?::([^/?#]*))?/;
+function authorityOk(uri) {
+  const m = URI_AUTHORITY.exec(uri);
+  if (!m) return true;
+  const port = m[2];
+  return Boolean(m[1]) && (port === undefined || port === '' || (/^[0-9]{1,5}$/.test(port) && Number(port) <= 65535));
+}
+const URI_PASSWORD = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#@]*:[^/?#@]*@/;
 const RESIDENCY = /^(A[B-Z]|[B-PR-WY][A-Z]|Q[A-L]|Z[A-Y])$/;
 
 const RUNNER_KIND_NAME = /^[a-z][a-z0-9-]{1,62}$/;
@@ -167,6 +181,18 @@ export function descriptorMemberProblems(d) {
     if (runner.credentialKind === 'subscription' && !Object.hasOwn(SUBSCRIPTION_RUNNERS, runner.kind)) problems.push("a subscription runs only in its vendor's runner: runner.kind claude-code, kimi-code or codex");
     for (const [k, v] of Object.entries(runner)) places.push([`/runner/${pointer(k)}`, v]);
   }
+  if ('source' in d) {
+    const source = isObj(d.source) ? d.source : {};
+    if (!isObj(d.source)) problems.push('source is {repository?}');
+    for (const k of Object.keys(source)) if (k !== 'repository') problems.push(`source has no member ${k}`);
+    if ('repository' in source) {
+      const repository = source.repository;
+      if (!(typeof repository === 'string' && SOURCE_URI.test(repository.replace(IP_LITERAL, '$1h')))) problems.push('source.repository is a URI (RFC 3986), such as https://github.com/owner/name');
+      else if (!authorityOk(repository)) problems.push('source.repository names a host, and a port of digits up to 65535 when it has one');
+      else if (URI_PASSWORD.test(repository)) problems.push('source.repository carries no password: it names the repository, never a credential');
+      places.push(['/source/repository', repository]);
+    }
+  }
   if ('peer' in d) {
     let peer = d.peer;
     if (!isObj(peer)) { problems.push('peer is {endpoint, custody, residency, maxDataClass}'); peer = {}; }
@@ -184,7 +210,7 @@ export function descriptorMemberProblems(d) {
     else if (isObj(runner) && runner.credentialKind === 'subscription') problems.push('a service offered to others never runs on a subscription (DEC-0061)');
   }
   for (const [place, value] of places) {
-    if (typeof value === 'string' && secretArgument(value)) problems.push(`FAC-SEM-086: ${place} holds a value shaped like a credential; it names a kind, a role or an installer`);
+    if (typeof value === 'string' && secretArgument(value)) problems.push(`FAC-SEM-086: ${place} holds a value shaped like a credential; it names ${place.startsWith('/source/') ? 'a repository' : 'a kind, a role or an installer'}`);
   }
   return problems;
 }

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_auth.py

@@ -367,14 +367,17 @@ def remote_token_file(service_id: str, instance: str = "default", directory: Opt
 def register_remote(*, service_id: str, name: str, origin: str, token: str, instance: str = "default",
                     summary: Optional[str] = None, doctor: Optional[List[str]] = None,
                     directory: Optional[Path] = None, installed_by: Any = None,
-                    runner: Optional[Dict[str, str]] = None, peer: Optional[Dict[str, Any]] = None) -> Path:
+                    runner: Optional[Dict[str, str]] = None, peer: Optional[Dict[str, Any]] = None,
+                    source: Optional[Dict[str, str]] = None) -> Path:
     """DEC-0019, installer side: register an online service on THIS computer — the token file
     (0600, never printed) and the descriptor. The same token is set on the platform as a secret.
 
     DEC-0061: ``installed_by`` defaults to ``{"by": "person", "role": "operator", "tool": "fabric-service
     register-remote"}`` (a person runs this); pass ``role: "administrator"`` for an organization's administrator, or a
     string as before. ``runner`` (``{kind?, credentialKind}``) says how its model calls sign in, as a kind and never a
-    credential; ``peer`` (``{endpoint, custody, residency, maxDataClass}``) offers it to others and needs ``runner``."""
+    credential; ``peer`` (``{endpoint, custody, residency, maxDataClass}``) offers it to others and needs ``runner``.
+    FAA-120: ``source`` (``{"repository": "https://github.com/owner/name"}``) names the repository of its code, as the
+    schema's ``source.repository``; Fabric Dashboards reads it."""
     if not token or len(token.strip()) < 16:
         raise ServiceError("the service token must be at least 16 characters.")
     root = directory or services_dir()
@@ -390,6 +393,8 @@ def register_remote(*, service_id: str, name: str, origin: str, token: str, inst
         descriptor["runner"] = dict(runner)
     if peer is not None:
         descriptor["peer"] = dict(peer)
+    if source is not None:
+        descriptor["source"] = dict(source) if isinstance(source, dict) else source
     if doctor:
         descriptor["commands"] = {"doctor": list(doctor)}
     problems = validate_descriptor(descriptor)

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_descriptor.py

@@ -46,7 +46,7 @@ from fabric_usage import (
 DASHBOARD_EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1"
 
 
-DASHBOARD_KIT = "fabric-dashboard-kit@1.1.3"
+DASHBOARD_KIT = "fabric-dashboard-kit@1.1.4"
 
 
 REFERENCE_THEMES = ("graphite", "fabric", "paper", "forest", "ocean", "ember", "contrast")
@@ -217,6 +217,16 @@ SUBSCRIPTION_RUNNERS = {"claude-code": "claude", "kimi-code": "kimi", "codex": "
 _PEER_ENDPOINT = re.compile(r"^https://(?P<host>([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63})(:([1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*)?\Z", re.ASCII)
 
 
+# FAA-120: source.repository is the schema's common `uri`: RFC 3986 characters only (unreserved, reserved and %HH),
+# the same in both twins; an authority, when there is one, names a host and a port of digits up to 65535, as Fabric's
+# `new URL` reads it. A user:password@ in it is a credential, never the name of a repository.
+_SOURCE_URI = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*:(?:[A-Za-z0-9._~:/?#@!$&'()*+,;=-]|%[0-9A-Fa-f]{2})+\Z")
+# Brackets belong to an IP-literal host only (RFC 3986 3.2.2); the literal is set aside before the character check.
+_IP_LITERAL = re.compile(r"^([A-Za-z][A-Za-z0-9+.-]*://(?:[^/?#@\[\]]*@)?)\[[0-9A-Fa-f:.vV]+\]")
+_URI_AUTHORITY = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*://(?:[^/?#@]*@)?(?P<host>\[[^\]]*\]|[^/?#:]*)(?::(?P<port>[^/?#]*))?")
+_URI_PASSWORD = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*://[^/?#@]*:[^/?#@]*@")
+
+
 _RESIDENCY = re.compile(r"^(A[B-Z]|[B-PR-WY][A-Z]|Q[A-L]|Z[A-Y])\Z", re.ASCII)
 
 
@@ -232,8 +242,16 @@ def _text(value: Any, low: int = 1, high: int = 200) -> bool:
     return isinstance(value, str) and low <= len(value) <= high
 
 
+def _authority_ok(uri: str) -> bool:
+    m = _URI_AUTHORITY.match(uri)
+    if not m:
+        return True
+    port = m.group("port")
+    return bool(m.group("host")) and (port is None or port == "" or (port.isdigit() and len(port) <= 5 and int(port) <= 65535))
+
+
 def descriptor_member_problems(descriptor: Dict[str, Any]) -> List[str]:
-    """DEC-0061 and DEC-0069 on a descriptor's `installedBy`, `runner` and `peer`, as the schema shapes them, with
+    """DEC-0061 and DEC-0069 on a descriptor's `installedBy`, `runner` and `peer`, and `source` (FAA-120), as the schema shapes them, with
     FAC-SEM-085 (a peer on a reserved name) and FAC-SEM-086 (a credential-shaped value in `runner` or `installedBy`,
     named by its place, never its value)."""
     import fabric_secrets  # noqa: E402 - beside this file; the contract's detector (DEC-0044)
@@ -273,6 +291,21 @@ def descriptor_member_problems(descriptor: Dict[str, Any]) -> List[str]:
         if runner.get("credentialKind") == "subscription" and runner.get("kind") not in SUBSCRIPTION_RUNNERS:
             problems.append("a subscription runs only in its vendor's runner: runner.kind claude-code, kimi-code or codex")
         places += [("/runner/%s" % _pointer(k), v) for k, v in runner.items()]
+    if "source" in descriptor:
+        source = descriptor.get("source")
+        if not isinstance(source, dict):
+            problems.append("source is {repository?}")
+            source = {}
+        problems += ["source has no member %s" % k for k in source if k != "repository"]
+        if "repository" in source:
+            repository = source["repository"]
+            if not (isinstance(repository, str) and _SOURCE_URI.match(_IP_LITERAL.sub(r"\1h", repository, count=1))):
+                problems.append("source.repository is a URI (RFC 3986), such as https://github.com/owner/name")
+            elif not _authority_ok(repository):
+                problems.append("source.repository names a host, and a port of digits up to 65535 when it has one")
+            elif _URI_PASSWORD.match(repository):
+                problems.append("source.repository carries no password: it names the repository, never a credential")
+            places.append(("/source/repository", repository))
     if "peer" in descriptor:
         peer = descriptor.get("peer")
         if not isinstance(peer, dict):
@@ -299,7 +332,8 @@ def descriptor_member_problems(descriptor: Dict[str, Any]) -> List[str]:
             problems.append("a service offered to others never runs on a subscription (DEC-0061)")
     for place, value in places:
         if isinstance(value, str) and fabric_secrets.secret_argument(value):
-            problems.append("FAC-SEM-086: %s holds a value shaped like a credential; it names a kind, a role or an installer" % place)
+            problems.append("FAC-SEM-086: %s holds a value shaped like a credential; it names %s" % (
+                place, "a repository" if place.startswith("/source/") else "a kind, a role or an installer"))
     return problems
 
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/kit.json

@@ -1,6 +1,6 @@
 {
  "name": "fabric-service-kit",
- "version": "0.49.2",
+ "version": "0.49.3",
  "about": "The service kit's modules in dependency order: a module imports only modules listed before it. Written by fabric_kit.py build; edit the order and layers by hand, never the digests.",
  "python": [
   {
@@ -209,7 +209,7 @@
     "fabric_secrets",
     "fabric_usage"
    ],
-   "sha256": "daf16f95b1810283b1386488e006e940a0cdfa5c3c8d09386ac33d29d58df78d"
+   "sha256": "ffb573c485f8b4d3c7b0a94ccc53472cd71d9800daf63b5f3f7ff53f2ac38026"
   },
   {
    "module": "fabric_auth",
@@ -221,7 +221,7 @@
     "fabric_paths",
     "fabric_platform"
    ],
-   "sha256": "55794587750f6c9f40935b74295d83d7096cb4b26a0b36ac292334cd87d8f853"
+   "sha256": "71115d18c67b7b806cb57b64b77e01ad97fc0e63e6f49ee850f778123617d905"
   },
   {
    "module": "fabric_events",
@@ -604,7 +604,7 @@
     "fabric-secrets",
     "fabric-usage"
    ],
-   "sha256": "95c0b7ff36c29d7c748f1fa6fb1767d6fe8c97fca7f1ee404559930abbd3cc84"
+   "sha256": "673bff656b403c3ef77a93878eaf4eda91c859df4b4275028fe303fcc153dd64"
   },
   {
    "module": "fabric-auth",
@@ -617,7 +617,7 @@
     "fabric-platform",
     "fabric-usage"
    ],
-   "sha256": "3ea6796470fcd829bc72a772fb7e4c37532a09d1e37ff41592dcf1a1a3074ca2"
+   "sha256": "782c2aa732f8320f604194660117640a7ea145e12b8155c04e88cef7c516a5b3"
   },
   {
    "module": "fabric-events",
@@ -3103,6 +3103,82 @@
    "fabric-openrouter.mjs": "ab6c4c7251d563980d895061ee19976bde2f364c21b6354efdd9a9027b1ea139",
    "fabric-package.schema.json": "2ba799f576fad0f608029223c4ccccd122152f1c5dbfa8ce8b31cd63ac92ad44",
    "share-registration.schema.json": "34b3997eeaf936ebc861342a23045634a7c18c19f01d7ed4198310d81989f5b0"
+  },
+  "0.49.3": {
+   "fabric_jsvalue.py": "12888a2c934a885d35999ac9782eaedc8d04946d9775213344a235a8814d3d28",
+   "fabric_time.py": "588f383da4ac6a243ea95b6ffc3a0aa99ca94245732dc4937734f190b7af4ae9",
+   "fabric_identifiers.py": "0fd814d521ac3aa39907458265870753046a73f48af3d8581ab864b93b211607",
+   "fabric_secrets.py": "68a0b5e9e90c468ec9ac67b2f0fd1848e08813d6ec1ec14a2a47337eb1a98911",
+   "fabric_crypto.py": "9c34aee20dbe4d6742e4fdbaab68ceb934bbe7dbd3a904c0010824ace16cdeaa",
+   "fabric_base.py": "f62bcc2ed9912660fa875d27a09f60867260cc4925f79873501fd9620be59611",
+   "fabric_platform.py": "a9350dff55ef0fb3a23cdb4d0320a15868b15a8deb10d2eb74d72c58740c284b",
+   "fabric_paths.py": "6c92af34292baddf7e10d3134d0a5b0bb23387741812a9f79c409cf1628bad23",
+   "fabric_estate.py": "a0ddc49d748c1efb1830de176998d6c8eac30f77d387c71eae12549c52aaab27",
+   "fabric_delegation.py": "6638a6039befe3b43f59018bab292e050931af21b544df1044cd5059572ded36",
+   "fabric_share.py": "78506fe1a60829c525dbf6266a0aa0749a2164290ed94da8249a20b4e9be5605",
+   "fabric_ceremonies.py": "a59e83cf4adb2669a9b98008e3d3a0cba991a35cbff97bc604fc82fe81cfd49f",
+   "fabric_package_schema.py": "e623f0408d38e3343ed66222fb812907c6c52e1a286eb1c1176ab2e64640c9ad",
+   "fabric_package.py": "ff533f1b3f92b4ea0f532fcec50b68c610d47549930eef8ad5247692a64dfb3c",
+   "fabric_protocols.py": "28e693282cddff8e4396ae39ce6fa935e875e8ddac7375bea2c189dd6fb04970",
+   "fabric_connections.py": "77d3ccf863c70e9209d21ef45c46a6db9c06237019bc20d54f8d3946873f3f11",
+   "fabric_lock.py": "ba2399d2137c7a7791b7133b9db9cca36693f4eb7e30955b25a75ade814e95ba",
+   "fabric_usage.py": "b1f335cab4625171a616cf68cf3fd892b18bdadcf4baec3a3a0fdcf12785c170",
+   "fabric_backups.py": "02dc5eb66ec956723d3ddba07b6dd15f6a9726d901f4d60edfd02eee57880ceb",
+   "fabric_descriptor.py": "ffb573c485f8b4d3c7b0a94ccc53472cd71d9800daf63b5f3f7ff53f2ac38026",
+   "fabric_auth.py": "71115d18c67b7b806cb57b64b77e01ad97fc0e63e6f49ee850f778123617d905",
+   "fabric_events.py": "0086886c2c29dbd5c9d152be9d375c5bdf4a29f89b8095baff8490c2bcd64e47",
+   "fabric_logs.py": "86dc55bfafa2a57264722e2403510a249b95de0e4a722b2e4bc3948e3bd93da9",
+   "fabric_supervisors.py": "a2dbf15aa1c4eb9de42996b413103fa4814afd2e4e66d1ab7315f30e06ab6841",
+   "fabric_service.py": "103ab4026f96e127c01cd91e4ad44f6b0ce2424ff33f078ed106b39e773a10e3",
+   "fabric_profiles.py": "26e21ec29c016000f8ca8053b7b489184854a73be1b7fdc0a18d12990203db9b",
+   "fabric_interop_rules.py": "b5f0ecb1791b4c50c5ac151f987f692ed7001bc74841a8a161125ec775145e09",
+   "fabric_interop.py": "f92fa111328fe3811438f733d8f0eb5295e6941c774123a78e26318bdcb35fc3",
+   "fabric_hub.py": "b9ac852e601b1d54cf61351677a628afc69faeed7d1fc74ebe541c1cf38e0c2a",
+   "fabric_board_shapes.py": "0a0e8d3d40e33dfd8c457aedb85330b2ff25f8c49a33eb6cbd5a5cc8a5007f7e",
+   "fabric_board_link.py": "b5bff994cb615c6a4bb0d88d020e3a59504166180e1fa1aea3be93224f2aeccb",
+   "fabric_board_session.py": "2845d7d758b06ac4588bdf825a471c201a46ce535a631805697b1e35495fead6",
+   "fabric_board_fixture.py": "69761ce205ec640762ec9b591c6903e5a87f844e8d423b041681924027e39d1e",
+   "fabric_board.py": "0f075894b3e352194fcaf3fc7d08dee4e9f1c215e859769ed85fa5010e4a1599",
+   "fabric_http.py": "5d7f72af3a73fdbe8c1f487ecf60cef23a7c46289eba542b03aff4706b8218d4",
+   "fabric_openrouter.py": "309f588f9c976b1061323f3161e35d86248afd5b59b16391afbfc4e1099ecd65",
+   "fabric-jsvalue.mjs": "dfbdb8c41584972c9389750a41719374a1cfc5652ed438dd1623025190b0106e",
+   "fabric-time.mjs": "3ff932069038a720df1c68c6492976906737b2e67e5c12d9c81c418597f661de",
+   "fabric-identifiers.mjs": "a18c2a501a4aa170bfd3d99e571ad6b7662649b4d3b9d2a540c002ea42811bbf",
+   "fabric-secrets.mjs": "6ad8ab18ac899ecc2384e8ec6a3fb689b92be3b9a5ce3a59b92a37d52da5d766",
+   "fabric-crypto.mjs": "038e03689701e3c9721a1e7f8e0a4d02a52d6a5d1661b0dc84035edc3ebbfcf6",
+   "fabric-base.mjs": "7804b2df7715dbbf9702a9b61b6b8cef2110f9a52b04cabd8fb0a66458d87512",
+   "fabric-platform.mjs": "a8119d95ebba4d589a9e401f5d6fc8dda62d59d44e4c1ff811d97fac3771ac0c",
+   "fabric-paths.mjs": "2201b4ed7126f260931b63e8386377b4317d8dcad419d109bf22c683e44b7f29",
+   "fabric-estate.mjs": "b6610aaad9d00d8a7f42955627fb81725950841455bcedfc050abb0e079f0f93",
+   "fabric-delegation.mjs": "dafde9ea327c88d92dc73d1400282b43dc6f84dd345a2d2b9b154304f65fc9d7",
+   "fabric-share.mjs": "d40a7405d7bd4c3213ed691330b7549afe8e023db0753b582e249714e672010d",
+   "fabric-ceremonies.mjs": "117d4374c9e95c930a38de7adbd4323774798f4fe6ec6f24afcd6f2c7298ca44",
+   "fabric-package-schema.mjs": "cd28092375db0fc21ffab1f0bb7794f7f8979ee08c64d3b9faf4b3845357caa6",
+   "fabric-package.mjs": "13913ea6d12056c3a31b8222b6c4aab8395941fe519913692e1a06d8672e1c88",
+   "fabric-protocols.mjs": "dc039ec3612d0090c9ba6a3a949b0b7df54712bead300dcb6cc8b9bc305cd183",
+   "fabric-connections.mjs": "303432e547ce563e90ca9ffcd827f5612f51d3582929834e1add0fdaf6485dcc",
+   "fabric-lock.mjs": "ac219ab0a326d5c43c7c4c255e0c3843d4794de795a60e3af661e7d5350ea052",
+   "fabric-usage.mjs": "1c4d18004639409624ac3516a02f2b60bbf55abdb612e9a96c37e83666eb87a7",
+   "fabric-backups.mjs": "849acdc6eba0fff648c8158e61f6b68cccd7bedf0880f7d5ec03a6a20f1e7005",
+   "fabric-descriptor.mjs": "673bff656b403c3ef77a93878eaf4eda91c859df4b4275028fe303fcc153dd64",
+   "fabric-auth.mjs": "782c2aa732f8320f604194660117640a7ea145e12b8155c04e88cef7c516a5b3",
+   "fabric-events.mjs": "c463d6ffcae24229a5c608d8fcea4268d2ccc5024b19fa10e5a452284068fa71",
+   "fabric-logs.mjs": "58467e5719c16e099d05bbedec47a95712506ab03c33f3cd4be1252e8498a946",
+   "fabric-supervisors.mjs": "9d61c1a17538a5e2453e33e5ae347337336748041bc054478a96dd51f3d4fc51",
+   "fabric-service.mjs": "1b4639a10c530c1241d317c5e9cf3a10cd96e5d9af8b29fc1b1844de5c63bfec",
+   "fabric-profiles.mjs": "314376cf2deb87f235fb18b11d3b532e211f585b9af0a9302b5f4cc39971b532",
+   "fabric-interop-rules.mjs": "57a8081307956e8c381119b361fa5232a7bf791815be8e3541eb5492820e2ea5",
+   "fabric-interop.mjs": "581983ec3e197e5c2340ad25e8468320c69a2459c90097c7fcf2699766b4fb26",
+   "fabric-hub.mjs": "c005115a864cfd67daa4862097bb14acfe5a60bf653897e5bf8a570dd80f1070",
+   "fabric-board-shapes.mjs": "c1db7b7bd0d58d82bb6d8dfbc3cd1547a256a333052d367e82ff1b3edf2804d7",
+   "fabric-board-link.mjs": "4cd6d4e21713a38c8e56f7d59db3148638b8c27c08e774d96a0f6283c6049e0a",
+   "fabric-board-session.mjs": "26c9b0b2818a4cedc5248b08ea6732e2ee4ee81e31f6fee2b572a019db813c93",
+   "fabric-board-fixture.mjs": "83c4b7e33ee47b68385faf2569d38d5c8a0c5cb0f8656090f41e1b0eed2f436e",
+   "fabric-board.mjs": "9e7bfe4d412521982224ef12bebfc2ff255eeeaf8d96cf40234ac18de68e7a59",
+   "fabric-http.mjs": "f886bcb49c4353d039387ac9568738dda26697a94dd07fc6a6204500f0bc27bf",
+   "fabric-openrouter.mjs": "ab6c4c7251d563980d895061ee19976bde2f364c21b6354efdd9a9027b1ea139",
+   "fabric-package.schema.json": "2ba799f576fad0f608029223c4ccccd122152f1c5dbfa8ce8b31cd63ac92ad44",
+   "share-registration.schema.json": "34b3997eeaf936ebc861342a23045634a7c18c19f01d7ed4198310d81989f5b0"
   }
  },
  "data": {

package/payload/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.49.2"
+  version: "0.49.3"
   contract-version: "0.1.0"
   contract-commit: "2f020a696453ae299b123517f14957f6a1354379"
 ---

package/payload/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md

@@ -19,7 +19,7 @@ compatibility: >-
   this plugin; Codex/Kimi use command hooks; Hermes/OpenCode/OpenClaw/Pi use native context plugins after opt-in.
 metadata:
   author: PassionCode.ai
-  version: "0.49.2"
+  version: "0.49.3"
 ---
 
 # Working with Fabric

package/payload/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session_env.py

@@ -57,7 +57,7 @@ SESSION_ID = re.compile(r"[A-Za-z0-9._:-]{1,128}")
 LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:(\d{1,5})")
 
 
-VERSION = "0.49.2"
+VERSION = "0.49.3"
 
 
 HOSTS = {"claude": "Claude Code", "codex": "Codex", "kimi": "Kimi Code",

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.2.37",
+  "version": "0.2.38",
   "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",